diff --git a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml index 25eb9e7b5152a..c28d5e6d90839 100644 --- a/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml +++ b/ci-operator/config/openshift/cert-manager-operator/openshift-cert-manager-operator-master.yaml @@ -473,82 +473,7 @@ tests: test: - as: deploy-operand cli: latest - commands: |- - set -o errexit - set -o nounset - set -o pipefail - - echo "Waiting for default cert-manager operand deployments..." - oc wait --for=create namespace/cert-manager --timeout=5m - oc wait --for=create -n cert-manager deployment/cert-manager --timeout=5m - oc wait --for=create -n cert-manager deployment/cert-manager-webhook --timeout=5m - oc wait --for=create -n cert-manager deployment/cert-manager-cainjector --timeout=5m - oc wait --for=condition=Available -n cert-manager deployment/cert-manager --timeout=5m - oc wait --for=condition=Available -n cert-manager deployment/cert-manager-webhook --timeout=5m - oc wait --for=condition=Available -n cert-manager deployment/cert-manager-cainjector --timeout=5m - - echo "Enabling TrustManager feature gate via subscription..." - # operator-sdk run bundle creates a versioned Subscription name - # (e.g. cert-manager-operator-v1-20-0-sub), not a fixed cert-manager-operator. - # Match e2e getCertManagerOperatorSubscription: list and patch the one present. - SUB=$(oc -n cert-manager-operator get subscriptions.operators.coreos.com -o jsonpath='{.items[0].metadata.name}') - if [[ -z "${SUB}" ]]; then - echo "No Subscription found in cert-manager-operator namespace" - oc -n cert-manager-operator get subscriptions.operators.coreos.com -o yaml || true - exit 1 - fi - echo "Patching Subscription ${SUB} (preserve existing env, match e2e patchSubscriptionWithEnvVars)" - PATCH=$(oc -n cert-manager-operator get "subscription/${SUB}" -o json | python3 -c 'import json,sys; sub=json.load(sys.stdin); cfg=(sub.get("spec") or {}).get("config") or {}; env=[e for e in (cfg.get("env") or []) if e.get("name")!="UNSUPPORTED_ADDON_FEATURES"]; env.append({"name":"UNSUPPORTED_ADDON_FEATURES","value":"TrustManager=true"}); print(json.dumps({"spec":{"config":{"env":env}}}))') - oc -n cert-manager-operator patch "subscription/${SUB}" --type=merge -p "${PATCH}" - - echo "Waiting for TrustManager feature gate on operator deployment env and rollout..." - FOUND=false - for _ in $(seq 1 60); do - ENV_VAL=$(oc -n cert-manager-operator get deploy/cert-manager-operator-controller-manager \ - -o jsonpath='{range .spec.template.spec.containers[0].env[?(@.name=="UNSUPPORTED_ADDON_FEATURES")]}{.value}{end}' 2>/dev/null || true) - if [[ "${ENV_VAL}" == "TrustManager=true" ]]; then - echo "Found UNSUPPORTED_ADDON_FEATURES=${ENV_VAL} on operator deployment" - FOUND=true - break - fi - sleep 5 - done - if [[ "${FOUND}" != "true" ]]; then - echo "Timed out waiting for UNSUPPORTED_ADDON_FEATURES=TrustManager=true on operator deployment" - oc -n cert-manager-operator get deploy/cert-manager-operator-controller-manager -o yaml || true - exit 1 - fi - oc -n cert-manager-operator rollout status deployment/cert-manager-operator-controller-manager --timeout=5m - - echo "Creating TrustManager CR (minimal, match e2e newTrustManagerCR)..." - oc apply -f - </dev/null || true) - if [[ "${READY}" == "True" ]]; then - echo "TrustManager CR is Ready" - FOUND=true - break - fi - sleep 5 - done - if [[ "${FOUND}" != "true" ]]; then - echo "Timed out waiting for TrustManager Ready=True" - oc get trustmanagers.operator.openshift.io cluster -o yaml || true - exit 1 - fi - oc wait --for=create -n cert-manager deployment/trust-manager --timeout=5m - oc wait --for=condition=Available -n cert-manager deployment/trust-manager --timeout=5m + commands: make deploy-trust-manager --warn-undefined-variables from: src resources: requests: @@ -564,6 +489,57 @@ tests: memory: 250Mi - ref: tls-scanner-run workflow: optional-operators-ci-operator-sdk-aws +- always_run: false + as: tls-pqc-readiness + optional: true + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: cert-manager-operator-bundle + env: + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: cert-manager-operator + OO_SECURITY_CONTEXT: restricted + PQC_CHECK: "true" + SCAN_NAMESPACE: cert-manager-operator,cert-manager + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - as: deploy-operand + cli: latest + commands: make deploy-trust-manager --warn-undefined-variables + from: src + resources: + requests: + cpu: 100m + - ref: tls-13 + - ref: tls-scanner-run + workflow: optional-operators-ci-operator-sdk-aws +- as: tls-pqc-readiness-periodic + cron: 0 6 * * 1 + steps: + cluster_profile: openshift-org-aws + dependencies: + OO_BUNDLE: cert-manager-operator-bundle + env: + OO_INSTALL_MODE: AllNamespaces + OO_INSTALL_NAMESPACE: cert-manager-operator + OO_SECURITY_CONTEXT: restricted + PQC_CHECK: "true" + SCAN_NAMESPACE: cert-manager-operator,cert-manager + SCANNER_CPU: "1" + SCANNER_MEMORY: 1Gi + test: + - as: deploy-operand + cli: latest + commands: make deploy-trust-manager --warn-undefined-variables + from: src + resources: + requests: + cpu: 100m + - ref: tls-13 + - ref: tls-scanner-run + workflow: optional-operators-ci-operator-sdk-aws zz_generated_metadata: branch: master org: openshift diff --git a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-periodics.yaml b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-periodics.yaml new file mode 100644 index 0000000000000..6fbc8d71b644e --- /dev/null +++ b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-periodics.yaml @@ -0,0 +1,95 @@ +periodics: +- agent: kubernetes + cluster: build09 + cron: 0 6 * * 1 + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - images/ci/Dockerfile + - images/ci/Dockerfile.coverage + - images/ci/certmanager.Dockerfile + - images/ci/istiocsr.Dockerfile + - images/ci/trustmanager.Dockerfile + extra_refs: + - base_ref: master + org: openshift + repo: cert-manager-operator + sparse_checkout_files: + - .ci-operator.yaml + - images/ci/Dockerfile + - images/ci/Dockerfile.coverage + - images/ci/certmanager.Dockerfile + - images/ci/istiocsr.Dockerfile + - images/ci/trustmanager.Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: periodic-ci-openshift-cert-manager-operator-master-tls-pqc-readiness-periodic + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness-periodic + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator diff --git a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml index 7e23744302146..71a6d994b85d7 100644 --- a/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml +++ b/ci-operator/jobs/openshift/cert-manager-operator/openshift-cert-manager-operator-master-presubmits.yaml @@ -1473,6 +1473,96 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )images,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^master$ + - ^master- + cluster: build01 + context: ci/prow/tls-pqc-readiness + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - images/ci/Dockerfile + - images/ci/Dockerfile.coverage + - images/ci/certmanager.Dockerfile + - images/ci/istiocsr.Dockerfile + - images/ci/trustmanager.Dockerfile + labels: + ci-operator.openshift.io/cloud: aws + ci-operator.openshift.io/cloud-cluster-profile: openshift-org-aws + ci.openshift.io/generator: prowgen + job-release: "4.22" + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-cert-manager-operator-master-tls-pqc-readiness + optional: true + rerun_command: /test tls-pqc-readiness + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=tls-pqc-readiness + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )tls-pqc-readiness,?($|\s.*) - agent: kubernetes always_run: false branches: